@attraccess/plugin-wago 0.1.0-nightly.925.2

package/dist/index.js

@@ -0,0 +1,743 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// backend/plugin.ts
+var plugin_exports = {};
+__export(plugin_exports, {
+  default: () => plugin_default
+});
+module.exports = __toCommonJS(plugin_exports);
+
+// backend/wago.controller.ts
+var import_common2 = require("@nestjs/common");
+var import_plugins_backend_sdk4 = require("@attraccess/plugins-backend-sdk");
+
+// backend/wago.service.ts
+var import_node_crypto = require("node:crypto");
+var import_common = require("@nestjs/common");
+
+// backend/protocol.ts
+var DISCOVERY_ROOT = "attraccess/wago/discovery";
+var REQUIRED_CAPABILITIES = ["claim", "heartbeat"];
+var SUPPORTED_PROTOCOL_MAJOR = 1;
+function parseAnnouncement(payload) {
+  let value;
+  try {
+    value = JSON.parse(payload.toString("utf8"));
+  } catch {
+    throw new Error("announcement is not valid JSON");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("announcement must be an object");
+  const input = value;
+  const required = ["hardwareId", "pairingCode", "protocolVersion", "runtimeVersion"];
+  for (const key of required)
+    if (typeof input[key] !== "string" || !input[key].trim()) throw new Error(`announcement ${key} is required`);
+  if (!Array.isArray(input.capabilities) || input.capabilities.some((item) => typeof item !== "string"))
+    throw new Error("announcement capabilities must be an array of strings");
+  if (input.sequence !== void 0 && (!Number.isSafeInteger(input.sequence) || input.sequence < 0))
+    throw new Error("announcement sequence must be a non-negative integer");
+  return {
+    hardwareId: input.hardwareId.trim(),
+    pairingCode: input.pairingCode.trim(),
+    enrollmentSecret: typeof input.enrollmentSecret === "string" ? input.enrollmentSecret.trim() : void 0,
+    fingerprint: typeof input.fingerprint === "string" ? input.fingerprint.trim() : void 0,
+    protocolVersion: input.protocolVersion.trim(),
+    runtimeVersion: input.runtimeVersion.trim(),
+    capabilities: input.capabilities,
+    sequence: input.sequence
+  };
+}
+function compatibilityError(announcement) {
+  const major = Number(announcement.protocolVersion.split(".")[0]);
+  if (!Number.isInteger(major))
+    return `Protocol version "${announcement.protocolVersion}" is invalid; install a CC100 runtime using protocol ${SUPPORTED_PROTOCOL_MAJOR}.x.`;
+  if (major !== SUPPORTED_PROTOCOL_MAJOR)
+    return `Protocol ${announcement.protocolVersion} is incompatible; this plugin supports protocol ${SUPPORTED_PROTOCOL_MAJOR}.x.`;
+  const missing = REQUIRED_CAPABILITIES.filter((capability) => !announcement.capabilities.includes(capability));
+  return missing.length ? `Controller is missing required capabilities: ${missing.join(", ")}. Update the CC100 runtime.` : null;
+}
+function discoveryTopic(hardwareId) {
+  return `${DISCOVERY_ROOT}/${hardwareId}`;
+}
+function heartbeatTopic(hardwareId) {
+  return `attraccess/wago/controllers/${hardwareId}/heartbeat`;
+}
+
+// backend/wago-controller.entity.ts
+var import_plugins_backend_sdk = require("@attraccess/plugins-backend-sdk");
+var WagoController = class {
+  constructor() {
+    __publicField(this, "id");
+    __publicField(this, "hardwareId");
+    __publicField(this, "trustState");
+    __publicField(this, "name");
+    __publicField(this, "mqttServerId");
+    __publicField(this, "enrollmentId");
+    __publicField(this, "pairingCodeHash");
+    __publicField(this, "fingerprint");
+    __publicField(this, "protocolVersion");
+    __publicField(this, "runtimeVersion");
+    __publicField(this, "capabilities");
+    __publicField(this, "lastSequence");
+    __publicField(this, "lastHeartbeatAt");
+    __publicField(this, "lastSeenAt");
+    __publicField(this, "compatibilityError");
+    __publicField(this, "createdAt");
+    __publicField(this, "updatedAt");
+  }
+};
+__decorateClass([
+  (0, import_plugins_backend_sdk.PrimaryGeneratedColumn)({ type: "integer" })
+], WagoController.prototype, "id", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "hardware_id", unique: true })
+], WagoController.prototype, "hardwareId", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "trust_state" })
+], WagoController.prototype, "trustState", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", nullable: true })
+], WagoController.prototype, "name", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "integer", name: "mqtt_server_id", nullable: true })
+], WagoController.prototype, "mqttServerId", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "integer", name: "enrollment_id", nullable: true })
+], WagoController.prototype, "enrollmentId", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "pairing_code_hash" })
+], WagoController.prototype, "pairingCodeHash", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", nullable: true })
+], WagoController.prototype, "fingerprint", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "protocol_version" })
+], WagoController.prototype, "protocolVersion", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "runtime_version" })
+], WagoController.prototype, "runtimeVersion", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar" })
+], WagoController.prototype, "capabilities", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "integer", name: "last_sequence", default: 0 })
+], WagoController.prototype, "lastSequence", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "last_heartbeat_at", nullable: true })
+], WagoController.prototype, "lastHeartbeatAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "last_seen_at" })
+], WagoController.prototype, "lastSeenAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "compatibility_error", nullable: true })
+], WagoController.prototype, "compatibilityError", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "created_at" })
+], WagoController.prototype, "createdAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "updated_at" })
+], WagoController.prototype, "updatedAt", 2);
+WagoController = __decorateClass([
+  (0, import_plugins_backend_sdk.Entity)({ name: "plugin_wago_controllers" })
+], WagoController);
+
+// backend/wago-settings.entity.ts
+var import_plugins_backend_sdk2 = require("@attraccess/plugins-backend-sdk");
+var WagoSettings = class {
+  constructor() {
+    __publicField(this, "id");
+    __publicField(this, "defaultMqttServerId");
+  }
+};
+__decorateClass([
+  (0, import_plugins_backend_sdk2.PrimaryGeneratedColumn)({ type: "integer" })
+], WagoSettings.prototype, "id", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk2.Column)({ type: "integer", name: "default_mqtt_server_id", nullable: true })
+], WagoSettings.prototype, "defaultMqttServerId", 2);
+WagoSettings = __decorateClass([
+  (0, import_plugins_backend_sdk2.Entity)({ name: "plugin_wago_settings" })
+], WagoSettings);
+
+// backend/wago-enrollment.entity.ts
+var import_plugins_backend_sdk3 = require("@attraccess/plugins-backend-sdk");
+var WagoEnrollment = class {
+  constructor() {
+    __publicField(this, "id");
+    __publicField(this, "mqttServerId");
+    __publicField(this, "hardwareId");
+    __publicField(this, "secretHash");
+    __publicField(this, "identity");
+    __publicField(this, "createdAt");
+    __publicField(this, "expiresAt");
+    __publicField(this, "revokedAt");
+    __publicField(this, "consumedAt");
+  }
+};
+__decorateClass([
+  (0, import_plugins_backend_sdk3.PrimaryGeneratedColumn)({ type: "integer" })
+], WagoEnrollment.prototype, "id", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk3.Column)({ type: "integer", name: "mqtt_server_id" })
+], WagoEnrollment.prototype, "mqttServerId", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk3.Column)({ type: "varchar", name: "hardware_id" })
+], WagoEnrollment.prototype, "hardwareId", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk3.Column)({ type: "varchar", name: "secret_hash", unique: true })
+], WagoEnrollment.prototype, "secretHash", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk3.Column)({ type: "varchar" })
+], WagoEnrollment.prototype, "identity", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk3.Column)({ type: "varchar", name: "created_at" })
+], WagoEnrollment.prototype, "createdAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk3.Column)({ type: "varchar", name: "expires_at" })
+], WagoEnrollment.prototype, "expiresAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk3.Column)({ type: "varchar", name: "revoked_at", nullable: true })
+], WagoEnrollment.prototype, "revokedAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk3.Column)({ type: "varchar", name: "consumed_at", nullable: true })
+], WagoEnrollment.prototype, "consumedAt", 2);
+WagoEnrollment = __decorateClass([
+  (0, import_plugins_backend_sdk3.Entity)({ name: "plugin_wago_enrollments" })
+], WagoEnrollment);
+
+// backend/wago.service.ts
+var PLUGIN_CONTEXT = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
+var STALE_AFTER_MS = 9e4;
+var ENROLLMENT_RETRY_MS = 6e4;
+var WagoService = class {
+  constructor(context) {
+    __publicField(this, "context", context);
+    __publicField(this, "controllers");
+    __publicField(this, "settings");
+    __publicField(this, "enrollments");
+    __publicField(this, "subscriptions", []);
+    __publicField(this, "enrollmentExpiryTimers", /* @__PURE__ */ new Map());
+    __publicField(this, "claimLocks", /* @__PURE__ */ new Map());
+    __publicField(this, "subscriptionRebuild", Promise.resolve());
+    __publicField(this, "subscriptionRetryTimer", null);
+    __publicField(this, "activeSubscriptionGeneration", 0);
+    __publicField(this, "destroyed", false);
+    this.controllers = context.getRepository(WagoController);
+    this.settings = context.getRepository(WagoSettings);
+    this.enrollments = context.getRepository(WagoEnrollment);
+  }
+  async onModuleInit() {
+    const enrollments = await this.enrollments.createQueryBuilder("enrollment").where("enrollment.consumedAt IS NULL").getMany();
+    for (const enrollment of enrollments) this.scheduleEnrollmentExpiry(enrollment);
+    await this.subscribeConfiguredServers();
+  }
+  onModuleDestroy() {
+    this.destroyed = true;
+    this.unsubscribe();
+    this.enrollmentExpiryTimers.forEach((timer) => clearTimeout(timer));
+    this.enrollmentExpiryTimers.clear();
+    if (this.subscriptionRetryTimer) clearTimeout(this.subscriptionRetryTimer);
+  }
+  async list() {
+    const controllers = await this.controllers.find({ order: { hardwareId: "ASC" } });
+    return controllers.map((controller) => ({
+      id: controller.id,
+      hardwareId: controller.hardwareId,
+      trustState: controller.trustState,
+      name: controller.name,
+      mqttServerId: controller.mqttServerId,
+      enrollmentId: controller.enrollmentId,
+      protocolVersion: controller.protocolVersion,
+      runtimeVersion: controller.runtimeVersion,
+      capabilities: controller.capabilities,
+      lastSequence: controller.lastSequence,
+      lastHeartbeatAt: controller.lastHeartbeatAt,
+      lastSeenAt: controller.lastSeenAt,
+      compatibilityError: controller.compatibilityError,
+      createdAt: controller.createdAt,
+      updatedAt: controller.updatedAt,
+      connectivity: this.connectivity(controller)
+    }));
+  }
+  async getSettings() {
+    const settings = await this.settings.findOneBy({ id: 1 });
+    if (settings) return settings;
+    await this.settings.createQueryBuilder().insert().values({ id: 1, defaultMqttServerId: null }).orIgnore().execute();
+    return this.settings.findOneByOrFail({ id: 1 });
+  }
+  async setDefaultMqttServer(serverId) {
+    if (serverId !== null && !await this.context.getMqttServerConfig(serverId))
+      throw new import_common.NotFoundException(`MQTT server ${serverId} not found`);
+    const settings = await this.getSettings();
+    settings.defaultMqttServerId = serverId;
+    await this.settings.save(settings);
+    await this.subscribeConfiguredServers();
+    return settings;
+  }
+  async createEnrollment(hardwareId, mqttServerId, manualCredentials) {
+    const normalizedHardwareId = hardwareId.trim();
+    if (!isValidHardwareId(normalizedHardwareId))
+      throw new import_common.ConflictException("a valid hardware ID without MQTT separators or wildcards is required");
+    const selectedServerId = mqttServerId ?? (await this.getSettings()).defaultMqttServerId;
+    if (!selectedServerId) throw new import_common.ConflictException("select an MQTT server before creating an enrollment package");
+    const server = await this.context.getMqttServerConfig(selectedServerId);
+    if (!server) throw new import_common.NotFoundException(`MQTT server ${selectedServerId} not found`);
+    const claimSecret = (0, import_node_crypto.randomBytes)(24).toString("base64url");
+    const identity = `wago-enrollment-${(0, import_node_crypto.randomBytes)(8).toString("hex")}`;
+    const expiresAt = new Date(Date.now() + 15 * 6e4).toISOString();
+    const provisionedCredential = await this.context.getMqttCredentialProvisioning().provision({
+      mqttServerId: selectedServerId,
+      identity,
+      username: identity,
+      vhost: "/",
+      topicPolicy: {
+        publish: [discoveryTopic(normalizedHardwareId)],
+        subscribe: [`${discoveryTopic(normalizedHardwareId)}/claim`]
+      }
+    });
+    if (!("password" in provisionedCredential) && !manualCredentials)
+      throw new import_common.ConflictException(
+        `Manual discovery credentials are required: ${provisionedCredential.instructions.join(" ")}`
+      );
+    const credential = "password" in provisionedCredential ? provisionedCredential : manualCredentials;
+    if (!credential?.username.trim() || !credential.password)
+      throw new import_common.ConflictException("a manual discovery username and password are required");
+    const enrollment = await this.enrollments.save(
+      this.enrollments.create({
+        mqttServerId: selectedServerId,
+        hardwareId: normalizedHardwareId,
+        secretHash: hash(claimSecret),
+        identity: credential.username,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        expiresAt
+      })
+    );
+    this.scheduleEnrollmentExpiry(enrollment);
+    await this.subscribeConfiguredServers().catch((error) => {
+      this.context.logger.warn(`Could not refresh WAGO MQTT subscriptions after enrollment: ${String(error)}`);
+      this.scheduleSubscriptionRetry();
+    });
+    return {
+      broker: { host: server.host, port: server.port, useTls: server.useTls },
+      username: credential.username,
+      password: "password" in credential ? credential.password : void 0,
+      claimSecret,
+      expiresAt,
+      manualInstructions: "instructions" in provisionedCredential ? provisionedCredential.instructions.map(
+        (instruction) => instruction.replaceAll(identity, () => credential.username)
+      ) : void 0
+    };
+  }
+  async claim(id, name, verifier, mqttServerId) {
+    return this.withClaimLock(id, () => this.claimController(id, name, verifier, mqttServerId));
+  }
+  async claimController(id, name, verifier, mqttServerId) {
+    const controller = await this.controllers.findOneBy({ id });
+    if (!controller) throw new import_common.NotFoundException(`WAGO controller ${id} not found`);
+    if (controller.trustState === "claimed") throw new import_common.ConflictException("controller has already been claimed");
+    if (!name.trim()) throw new import_common.ConflictException("a controller name is required");
+    if (!this.matchesVerifier(controller, verifier))
+      throw new import_common.ConflictException("physical pairing code or fingerprint does not match the controller");
+    if (controller.compatibilityError) throw new import_common.ConflictException(controller.compatibilityError);
+    const selectedServerId = mqttServerId ?? controller.mqttServerId;
+    if (!selectedServerId) throw new import_common.ConflictException("select an MQTT server before claiming this controller");
+    if (selectedServerId !== controller.mqttServerId)
+      throw new import_common.ConflictException("claim the controller on the MQTT server used for its enrollment package");
+    if (!await this.context.getMqttServerConfig(selectedServerId))
+      throw new import_common.NotFoundException(`MQTT server ${selectedServerId} not found`);
+    const enrollment = await this.activeEnrollment(controller.enrollmentId);
+    if (!enrollment)
+      throw new import_common.ConflictException(
+        "the controller enrollment package has expired or was already consumed; create a new one"
+      );
+    const identity = `wago-controller-${controller.hardwareId}`;
+    const credential = await this.context.getMqttCredentialProvisioning().provision({
+      mqttServerId: selectedServerId,
+      identity,
+      username: identity,
+      vhost: "/",
+      topicPolicy: {
+        publish: [`attraccess/wago/controllers/${controller.hardwareId}/#`],
+        subscribe: [`attraccess/wago/controllers/${controller.hardwareId}/desired/#`]
+      }
+    });
+    if (!("password" in credential)) {
+      throw new import_common.ConflictException(`Manual credential provisioning is required: ${credential.instructions.join(" ")}`);
+    }
+    let credentialDelivered = false;
+    const previousController = {
+      trustState: controller.trustState,
+      name: controller.name,
+      mqttServerId: controller.mqttServerId,
+      updatedAt: controller.updatedAt
+    };
+    try {
+      await this.revokeEnrollment(enrollment);
+      controller.trustState = "claimed";
+      controller.name = name.trim();
+      controller.mqttServerId = selectedServerId;
+      controller.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await this.controllers.save(controller);
+      await this.context.mqtt.publish(
+        selectedServerId,
+        `${discoveryTopic(controller.hardwareId)}/claim`,
+        JSON.stringify({ username: credential.username, password: credential.password }),
+        { qos: 1 }
+      );
+      credentialDelivered = true;
+      await this.context.mqtt.publish(selectedServerId, discoveryTopic(controller.hardwareId), "", {
+        qos: 1,
+        retain: true
+      });
+      return controller;
+    } catch (error) {
+      if (!credentialDelivered) {
+        await this.context.getMqttCredentialProvisioning().revoke({ mqttServerId: selectedServerId, identity, username: identity, vhost: "/" }).catch(() => void 0);
+        Object.assign(controller, previousController);
+        await this.controllers.save(controller).catch((rollbackError) => {
+          this.context.logger.warn(
+            `Could not restore WAGO controller ${controller.id} after claim failure: ${String(rollbackError)}`
+          );
+        });
+      }
+      throw error;
+    } finally {
+      await this.subscribeConfiguredServers().catch((error) => {
+        this.context.logger.warn(`Could not refresh WAGO MQTT subscriptions after claim: ${String(error)}`);
+        this.scheduleSubscriptionRetry();
+      });
+    }
+  }
+  async subscribeConfiguredServers() {
+    if (this.destroyed) return;
+    const rebuild = this.subscriptionRebuild.then(() => this.rebuildSubscriptions());
+    this.subscriptionRebuild = rebuild.catch(() => void 0);
+    return rebuild;
+  }
+  async rebuildSubscriptions() {
+    if (this.destroyed) return;
+    const settings = await this.getSettings();
+    const [controllers, enrollments] = await Promise.all([this.controllers.find(), this.activeEnrollments()]);
+    const serverIds = /* @__PURE__ */ new Set();
+    if (settings.defaultMqttServerId) serverIds.add(settings.defaultMqttServerId);
+    controllers.filter((controller) => controller.trustState === "claimed").forEach((controller) => {
+      const serverId = controller.mqttServerId ?? settings.defaultMqttServerId;
+      if (serverId) serverIds.add(serverId);
+    });
+    enrollments.forEach((enrollment) => {
+      serverIds.add(enrollment.mqttServerId);
+    });
+    const generation = this.activeSubscriptionGeneration + 1;
+    const replacements = [];
+    try {
+      for (const serverId of serverIds) {
+        replacements.push(
+          await this.context.mqtt.subscribe(serverId, `${DISCOVERY_ROOT}/+`, async (message) => {
+            if (!this.isActiveSubscriptionGeneration(generation)) return;
+            await this.onDiscovery(serverId, message.topic, message.payload);
+          })
+        );
+        for (const controller of controllers.filter(
+          (item) => item.trustState === "claimed" && (item.mqttServerId ?? settings.defaultMqttServerId) === serverId
+        )) {
+          replacements.push(
+            await this.context.mqtt.subscribe(serverId, heartbeatTopic(controller.hardwareId), async (message) => {
+              if (!this.isActiveSubscriptionGeneration(generation)) return;
+              await this.onHeartbeat(controller.hardwareId, message.payload);
+            })
+          );
+        }
+      }
+    } catch (error) {
+      replacements.forEach((subscription) => subscription.unsubscribe());
+      throw error;
+    }
+    if (this.destroyed) {
+      replacements.forEach((subscription) => subscription.unsubscribe());
+      return;
+    }
+    this.activeSubscriptionGeneration = generation;
+    this.unsubscribe();
+    this.subscriptions.push(...replacements);
+  }
+  unsubscribe() {
+    this.subscriptions.splice(0).forEach((subscription) => subscription.unsubscribe());
+  }
+  isActiveSubscriptionGeneration(generation) {
+    return !this.destroyed && generation === this.activeSubscriptionGeneration;
+  }
+  async onDiscovery(serverId, topic, payload) {
+    const hardwareId = topic.slice(`${DISCOVERY_ROOT}/`.length);
+    if (!isValidHardwareId(hardwareId)) return;
+    let announcement;
+    try {
+      announcement = parseAnnouncement(payload);
+    } catch (error) {
+      this.context.logger.warn(
+        `Ignoring invalid WAGO announcement: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return;
+    }
+    if (announcement.hardwareId !== hardwareId) {
+      this.context.logger.warn(`Ignoring WAGO announcement with mismatched hardware ID on ${topic}`);
+      return;
+    }
+    const enrollment = announcement.enrollmentSecret ? await this.validEnrollment(announcement.enrollmentSecret, serverId, hardwareId) : null;
+    if (!enrollment) {
+      this.context.logger.warn(`Ignoring WAGO announcement without a valid enrollment secret on ${topic}`);
+      return;
+    }
+    const existing = await this.controllers.findOneBy({ hardwareId });
+    if (existing?.trustState === "claimed") return;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const candidate = existing ?? this.controllers.create({
+      hardwareId,
+      trustState: "untrusted",
+      name: null,
+      mqttServerId: serverId,
+      enrollmentId: enrollment.id,
+      pairingCodeHash: "",
+      fingerprint: null,
+      protocolVersion: "",
+      runtimeVersion: "",
+      capabilities: "[]",
+      lastSequence: 0,
+      lastHeartbeatAt: null,
+      lastSeenAt: now,
+      compatibilityError: null,
+      createdAt: now,
+      updatedAt: now
+    });
+    candidate.mqttServerId = serverId;
+    candidate.enrollmentId = enrollment.id;
+    candidate.pairingCodeHash = hash(announcement.pairingCode);
+    candidate.fingerprint = announcement.fingerprint ?? null;
+    candidate.protocolVersion = announcement.protocolVersion;
+    candidate.runtimeVersion = announcement.runtimeVersion;
+    candidate.capabilities = JSON.stringify(announcement.capabilities);
+    candidate.lastSequence = announcement.sequence ?? candidate.lastSequence;
+    candidate.lastSeenAt = now;
+    candidate.compatibilityError = compatibilityError(announcement);
+    candidate.updatedAt = now;
+    await this.controllers.save(candidate);
+  }
+  async onHeartbeat(hardwareId, payload) {
+    let heartbeat;
+    try {
+      heartbeat = parseAnnouncement(payload);
+    } catch (error) {
+      this.context.logger.warn(
+        `Ignoring invalid WAGO heartbeat: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return;
+    }
+    if (heartbeat.hardwareId !== hardwareId) return;
+    const controller = await this.controllers.findOneBy({ hardwareId });
+    if (!controller || controller.trustState !== "claimed" || heartbeat.sequence !== void 0 && heartbeat.sequence < controller.lastSequence)
+      return;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    controller.protocolVersion = heartbeat.protocolVersion;
+    controller.runtimeVersion = heartbeat.runtimeVersion;
+    controller.capabilities = JSON.stringify(heartbeat.capabilities);
+    controller.lastSequence = heartbeat.sequence ?? controller.lastSequence;
+    controller.lastHeartbeatAt = now;
+    controller.lastSeenAt = now;
+    controller.compatibilityError = compatibilityError(heartbeat);
+    controller.updatedAt = now;
+    await this.controllers.save(controller);
+  }
+  connectivity(controller) {
+    if (controller.trustState === "untrusted") return "untrusted";
+    return controller.lastHeartbeatAt && Date.now() - Date.parse(controller.lastHeartbeatAt) <= STALE_AFTER_MS ? "online" : "stale";
+  }
+  matchesVerifier(controller, verifier) {
+    const value = verifier.trim();
+    return Boolean(value) && Boolean(controller.fingerprint) && value === controller.fingerprint || safeEqual(hash(value), controller.pairingCodeHash);
+  }
+  async validEnrollment(secret, serverId, hardwareId) {
+    const enrollment = await this.enrollments.findOneBy({
+      secretHash: hash(secret),
+      mqttServerId: serverId,
+      hardwareId
+    });
+    return enrollment && this.isActiveEnrollment(enrollment) ? enrollment : null;
+  }
+  async activeEnrollment(id) {
+    if (!id) return null;
+    const enrollment = await this.enrollments.findOneBy({ id });
+    return enrollment && this.isActiveEnrollment(enrollment) ? enrollment : null;
+  }
+  activeEnrollments() {
+    return this.enrollments.createQueryBuilder("enrollment").where("enrollment.consumedAt IS NULL").andWhere("enrollment.revokedAt IS NULL").andWhere("enrollment.expiresAt > :now", { now: (/* @__PURE__ */ new Date()).toISOString() }).getMany();
+  }
+  isActiveEnrollment(enrollment) {
+    return !enrollment.consumedAt && !enrollment.revokedAt && Date.parse(enrollment.expiresAt) > Date.now();
+  }
+  scheduleEnrollmentExpiry(enrollment, delay = Date.parse(enrollment.expiresAt) - Date.now()) {
+    if (enrollment.consumedAt) return;
+    const existing = this.enrollmentExpiryTimers.get(enrollment.id);
+    if (existing) clearTimeout(existing);
+    this.enrollmentExpiryTimers.set(
+      enrollment.id,
+      setTimeout(
+        () => {
+          this.enrollmentExpiryTimers.delete(enrollment.id);
+          if (this.destroyed) return;
+          void this.revokeEnrollment(enrollment).then(() => this.subscribeConfiguredServers()).catch((error) => {
+            this.context.logger.warn(`Could not revoke expired WAGO enrollment ${enrollment.id}: ${String(error)}`);
+            if (!enrollment.consumedAt) this.scheduleEnrollmentExpiry(enrollment, ENROLLMENT_RETRY_MS);
+            this.scheduleSubscriptionRetry();
+          });
+        },
+        Math.max(0, delay)
+      )
+    );
+  }
+  async revokeEnrollment(enrollment) {
+    if (!enrollment.revokedAt) {
+      const manual = await this.context.getMqttCredentialProvisioning().revoke({
+        mqttServerId: enrollment.mqttServerId,
+        identity: enrollment.identity,
+        username: enrollment.identity,
+        vhost: "/"
+      });
+      if (manual)
+        throw new import_common.ConflictException(`Manual credential revocation is required: ${manual.instructions.join(" ")}`);
+      enrollment.revokedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await this.enrollments.save(enrollment);
+    }
+    enrollment.consumedAt = (/* @__PURE__ */ new Date()).toISOString();
+    await this.enrollments.save(enrollment);
+    const timer = this.enrollmentExpiryTimers.get(enrollment.id);
+    if (timer) clearTimeout(timer);
+    this.enrollmentExpiryTimers.delete(enrollment.id);
+  }
+  async withClaimLock(id, operation) {
+    const previous = this.claimLocks.get(id) ?? Promise.resolve();
+    let release;
+    const lock = new Promise((resolve) => {
+      release = resolve;
+    });
+    this.claimLocks.set(id, lock);
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+      if (this.claimLocks.get(id) === lock) this.claimLocks.delete(id);
+    }
+  }
+  scheduleSubscriptionRetry() {
+    if (this.destroyed || this.subscriptionRetryTimer) return;
+    this.subscriptionRetryTimer = setTimeout(() => {
+      this.subscriptionRetryTimer = null;
+      if (this.destroyed) return;
+      void this.subscribeConfiguredServers().catch((error) => {
+        this.context.logger.warn(`Could not refresh WAGO MQTT subscriptions: ${String(error)}`);
+        this.scheduleSubscriptionRetry();
+      });
+    }, ENROLLMENT_RETRY_MS);
+  }
+};
+WagoService = __decorateClass([
+  (0, import_common.Injectable)(),
+  __decorateParam(0, (0, import_common.Inject)(PLUGIN_CONTEXT))
+], WagoService);
+function hash(value) {
+  return (0, import_node_crypto.createHash)("sha256").update(value).digest("hex");
+}
+function safeEqual(left, right) {
+  return left.length === right.length && (0, import_node_crypto.timingSafeEqual)(Buffer.from(left), Buffer.from(right));
+}
+function isValidHardwareId(hardwareId) {
+  return Boolean(hardwareId) && !/[/+#]/.test(hardwareId);
+}
+
+// backend/wago.controller.ts
+var WagoControllerApi = class {
+  constructor(wago) {
+    __publicField(this, "wago", wago);
+  }
+  list() {
+    return this.wago.list();
+  }
+  settings() {
+    return this.wago.getSettings();
+  }
+  setSettings(body) {
+    return this.wago.setDefaultMqttServer(body?.defaultMqttServerId ?? null);
+  }
+  enrollment(body) {
+    const manualCredentials = body?.manualUsername || body?.manualPassword ? { username: body.manualUsername ?? "", password: body.manualPassword ?? "" } : void 0;
+    return this.wago.createEnrollment(body?.hardwareId ?? "", body?.mqttServerId, manualCredentials);
+  }
+  claim(id, body) {
+    return this.wago.claim(id, body?.name ?? "", body?.verifier ?? "", body?.mqttServerId);
+  }
+};
+__decorateClass([
+  (0, import_common2.Get)("controllers")
+], WagoControllerApi.prototype, "list", 1);
+__decorateClass([
+  (0, import_common2.Get)("settings")
+], WagoControllerApi.prototype, "settings", 1);
+__decorateClass([
+  (0, import_common2.Post)("settings"),
+  __decorateParam(0, (0, import_common2.Body)())
+], WagoControllerApi.prototype, "setSettings", 1);
+__decorateClass([
+  (0, import_common2.Post)("enrollments"),
+  __decorateParam(0, (0, import_common2.Body)())
+], WagoControllerApi.prototype, "enrollment", 1);
+__decorateClass([
+  (0, import_common2.Post)("controllers/:id/claim"),
+  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
+  __decorateParam(1, (0, import_common2.Body)())
+], WagoControllerApi.prototype, "claim", 1);
+WagoControllerApi = __decorateClass([
+  (0, import_plugins_backend_sdk4.Auth)("resources.update"),
+  (0, import_common2.Controller)("wago"),
+  __decorateParam(0, (0, import_common2.Inject)(WagoService))
+], WagoControllerApi);
+
+// backend/plugin.ts
+var PLUGIN_CONTEXT2 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
+var WagoPluginModule = class {
+};
+var plugin = {
+  entities: [WagoController, WagoSettings, WagoEnrollment],
+  register(context) {
+    return {
+      module: WagoPluginModule,
+      controllers: [WagoControllerApi],
+      providers: [{ provide: PLUGIN_CONTEXT2, useValue: context }, WagoService]
+    };
+  }
+};
+var plugin_default = plugin;